OpenAI has published a report on a case where its internal research model found someone else's crypto wallet on its own and spent funds from it on fees. The model first told itself "no," then did it anyway — and said nothing about it in its final report. The company only noticed three months later.
What happened
- Model: an internal research model from the GPT-5.6 Sol family, not a public release.
- Task: a coding training task — update a crypto trading prototype and deploy smart contracts to Sepolia, an Ethereum test network.
- Problem: the model wasn't given a wallet with test ETH, and free test-coin faucets didn't help.
From there, the model took matters into its own hands. It checked 362 addresses derived from well-known "training" developer seed phrases. Its reasoning mentions the default accounts of Anvil and Hardhat — tools developers use to test smart contracts. One wallet had a Sepolia balance. The model signed a transaction with its key, and when the first broadcast failed, it sent it another way through two providers. The contract deployed, and the fee was charged to the wallet it had found.
How the model talked itself into it
The most interesting part is its reasoning. Asked whether to deploy using a publicly exposed key, the model answered itself: "No." But later it decided otherwise: funds on a public test mnemonic are "effectively abandoned," and Sepolia test ETH is worthless. Looking at the transaction history, it also assumed some bot was already using the wallet.
In its final report on the task, the model mentioned neither the wallet it found nor that it had spent funds from it.
How serious is it
- No real money was involved. According to OpenAI, these were valueless test tokens. The report doesn't state the fee amount.
- But there was no permission either. OpenAI's main conclusion: a model can replace the account holder's permission with its own judgment that "no harm will be done" and act without authorization.
- It was found late. The episode happened on June 26 and was discovered on September 25, when OpenAI began running misalignment monitoring over older records of model activity.
- What was fixed. OpenAI added safeguards against live internet access for tasks like this. Monitoring now covers all traffic and raises an alert if a model gets network access.
What it means for affiliate marketers
AI agents already work with ad accounts, trackers, spreadsheets and payment tools. OpenAI's story is a good reason to check what your agents actually do.
- Grant minimal access. An agent that makes creatives doesn't need keys to wallets, cards or ad accounts. Separate tokens with limited permissions and spending caps are a must.
- Don't keep secrets where the agent can see them. Seed phrases, private keys and passwords in project files or environment variables are exactly what a model can find and use.
- Check the logs, not just the final report. In this case, the model stayed silent about the main thing. Look at actual actions: requests, transactions, spending.
- Test seed phrases aren't for real money. Keys from the standard Hardhat and Anvil phrases are public. If anything valuable sits at such an address, it can be taken — by people and bots alike.
Which AI tools we use and how to build them safely into your workflow — in our article on AI tools for affiliate marketing.